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ABSTRACT 

In this paper, a baseline system which utilizes dual-channel 
sensor measurements for aircraft engine on-line diagnostics is 
developed. This system is composed of a linear on-board 
engine model (LOBEM) and fault detection and isolation (FDI) 
logic. The LOBEM provides the analytical third channel 
against which the dual-channel measurements are compared. 
When the discrepancy among the triplex channels exceeds a 
tolerance level, the FDI logic determines the cause of the 
discrepancy. Through this approach, the baseline system 
achieves the following objectives: 1) anomaly detection, 2) 
component fault detection, and 3) sensor fault detection and 
isolation. The performance of the baseline system is evaluated 
in a simulation environment using faults in sensors and 
components. 


INTRODUCTION 

Aircraft gas turbine engines have evolved into a highly 
complex and sophisticated system to meet ever-increasing 
demands. The evolution of aircraft engine technologies has 
been driven by the need for improved fuel efficiency, 
reliability, operability, availability, and maintainability [1,2]. 
The reliability aspect of modem aircraft engines has been 
enhanced by equipping the engines with a dual channel full- 
authority digital electronic control (FADEC). In this setup, a 
single engine parameter is measured by a dual-channel sensor,^ 
and the FADEC receives redundant measurements through dual 
channels. If a single channel fails, this failure is 
accommodated by utilizing the measurement on the other 
channel. 


Such an accommodation action can be taken only if the 
identity of the faulty sensor and its failed channel are known. 
Thus, in order to fully utilize the available redundancy for 
sensor fault accommodation, the ability to diagnose the sensors 
on line (real-time, in-flight) is required. The sensor fault 
detection and isolation process is initiated by cross-checking 
the redundant measurements of each dual-channel sensor. If 
both channels agree within a pre-established tolerance, the 
measurements on both channels are acceptable. If not, the 
cross-check fails, and one of the dual channels is considered 
faulty. A challenge arises in the subsequent process of 
identifying the faulty channel. Even if redundant 
measurements do not agree with each other, both of them may 
pass the range and rate checks [3], Such a failure is called an 
in-range sensor fault and causes some difficulty in determining 
which channel is the failed one. 

The above problem can be addressed by providing an 
analytical third channel. This third channel functions as a 
referee in the decision making; the channel that disagrees most 
with the referee is likely the faulty channel. The analytical 
third channel is embedded within the FADEC in the form of an 
analytical representation of the real engine. This analytical 
representation is called an on-board engine model (OBEM) and 
has been a key element in on-line fault detection and 


A dual-channel sensor is defined in this paper as a device which 
produces two measurements of the same engine parameter. The redundant 
measurements are referred to as channel A and channel B measurements. It is 
assumed that failures can occur in either one or both channels of the sensor. 
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accommodation since the advent of the FADEC [4,5]. The 
OBEM captures the real engine’s nominal behavior to some 
extent and provides expected engine output values in real time. 
In Ref. [3], a linear on-board engine model (LOBEM), which is 
composed of piecewise linear models generated at multiple 
operating conditions, is utilized for on-line sensor fault 
diagnostics. 

In this paper, an on-line diagnostic system that utilizes the 
LOBEM as an analytical third channel is developed for the 
aircraft engine application. This system is referred to as the 
baseline system, and it has a simple structure composed of the 
LOBEM and fault detection and isolation (FDI) logic. When 
the discrepancy among the triplex channels exceeds a tolerance 
level, the FDI logic determines the cause of the discrepancy. 
Through this approach, the baseline system achieves the 
following objectives: 1) anomaly detection, 2) component fault 
detection, and 3) sensor fault detection and isolation. Because 
of its simplicity, the baseline system can be executed with the 
computing power currently available in practice. Therefore, 
diagnostic performance representative of what is potentially 
achievable in the field can be determined through evaluation of 
the baseline system. 

In the following section, two main components of the 
baseline system — the LOBEM and the FDI logic — are 
discussed in detail. The influence of engine health degradation 
on the on-line diagnostic performance is also discussed. Then, 
the design approach is applied to a large commercial aircraft 
engine model. The performance of the baseline system is 
evaluated using simulated faults in sensors and components. 


TMHSBL Combustor liner metal temperature 

VBV Variable bleed valve 

VSV Variable stator vane 

WF36 Fuel flow 

XN12 Fan speed, measured 

XN25 Core speed, measured 

XNH Core speed, actual 

XNL Fan speed, actual 

e Environmental parameter vector 

h Health parameter vector 

h re f Reference health condition vector 

u cm( i Control command vector 

v Sensor noise vector 

x State variable vector 

y Sensor output vector (controls/diagnostics) 

z Sensor output vector (ambient/engine inlet) 


DEVELOPMENT OF THE BASELINE SYSTEM FOR 
ON-LINE DIAGNOSTICS 

The objective of on-line diagnostics for aircraft engines is 
to detect, and if possible isolate, any fault as early as possible. 
With timely detection and accurate isolation of the fault, the 
necessary corrective actions can be taken to avoid undesirable 
engine operation and maintenance costs. To achieve this 
objective, the baseline system continuously monitors engine 
outputs for anomalous signatures induced by faults. The 
baseline system developed in this paper is composed of the 
LOBEM and FDI logic. Each component is described in this 
section. 


NOMENCLATURE 

BST Booster 

CFS Component fault signature 

FADEC Full Authority Digital Electronic Control 

FDI Fault Detection and Isolation 

HPC High Pressure Compressor 

HPT High Pressure Turbine 

LOBEM Linear On-Board Engine Model 

LPT Low Pressure Turbine 

P2 Engine inlet pressure 

P25 HPC inlet pressure 

P am b Ambient pressure 

PLA Power Lever Angle 

PS3 Combustor inlet static pressure 

T2 Engine inlet temperature 

T25 HPC inlet temperature 

T3 Combustor inlet temperature 

T49 LPT inlet temperature 

TMHS23 BST metal temperature 

TMHS3 HPC metal temperature 

TMHS4 1 HPT nozzle metal temperature 

TMHS42 HPT metal temperature 

TMHS5 LPT metal temperature 

TMHSBC Combustor case metal temperature 


Linear On-Board Engine Model (LOBEM) 

An aircraft engine under consideration for on-line 
diagnostics is described by nonlinear equations of the following 
form: 


x = f{x,h,u cmd ,e ) 
y = g{x,h,u cmd ,e ) 

The vectors x, u cm d, and e contain state variables, control 
command inputs, and environmental parameters, respectively. 
The vector h contains health parameters that indicate the engine 
health condition. Health parameters are efficiencies and flow 
capacities of the engine components such as the compressors 
and turbines. As they deviate from their nominal health 
condition, the performance delivered by each component 
degrades. For given inputs, the nonlinear functions / and g 
generate the state derivative vector x and engine output vector 
y. The engine outputs are measured by sensors with dual- 
channels A and B as follows: 


Ta = T + v a 

Tb = y + v n 


(2) 
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The vectors v A and v B represent the zero-mean, normally 
distributed white noise that corrupts the measurements on dual 
channels. 

The baseline system described in this paper uses the 
LOBEM as an analytical third channel. The LOBEM is 
developed through the linearization of a high-fidelity nonlinear 
engine model in the following form: 


and y L0BEM ) and determines a root cause when an anomalous 
signature is detected in these channels. 

There are multiple comparisons that are carried out by the 
FDI logic. The first comparison is a cross-check between 
channels A and B. There are a total of m engine parameters 
which are measured by m dual-channel sensors. For each 
measured parameter, the residual is computed as follows: 


x=f{x,h ref , u cmd ,e) 
y = g{x,h ref ,u cmd ,e) 


y a “Tb 




(5) 


The vectors x and y contain the state and output variables of 
the nonlinear engine model, respectively. The vector h ref 

contains health parameters that indicate the health condition of 
the nonlinear engine model. The health condition prescribed 
by the vector h, is called the “health baseline” since it is the 

reference health condition at which the nonlinear model is 
linearized. It should be noted that the form of the nonlinear 
engine model is similar to the assumed form of the actual 
engine in Eq. (1). It is critical in any model-based analysis to 
have a model that accurately represents the actual system. 

Through the linearization of the nonlinear engine model in 
Eq. (3), the LOBEM is developed. The LOBEM is represented 
by the linear state-space equations of the following form: 

* LOBEM ~ -MX LOBEM ~ X ss ) + ^( U cmd _ U ss ) ^ 

y LOBEM = LOBEM ~ X ss ) ^{ U cmd _ ) “*“ Tsj 

The vectors x LOBEM and y LOBEM contain the state and output 
variables of the LOBEM, respectively. The state-space 
matrices A , B, C, and D are of appropriate dimensions. The 
vectors x , y , and u contain the steady-state values at 
which the nonlinear engine model is trimmed for linearization. 
A set of state-space matrices and steady-state vectors represents 
a linear engine model at a specific operating condition. To 
cover a wide operational range of the aircraft engine, linear 
models must be generated at multiple operating conditions. 
Such linear models generated at multiple operating conditions 
are called piecewise linear models and implemented on the 
FADEC in table lookup form. For real-time execution of Eq. 
(4), the piecewise linear models are interpolated as the 
operating condition of the actual engine moves from one point 
to another. Because of its simple structure, the LOBEM in Eq. 
(4) is suited for on-line application. 

Fault Detection and Isolation (FDI) Logic 

Another component of the baseline system is the FDI 
logic. The FDI logic compares the triplex channels ( y A , y B , 


where cr indicates the standard deviation of the measurement 
uncertainty of the i th sensor. The residual in Eq. (5) is called 
the “dual-channel residual.” The dual-channel residual for each 
sensor is compared against a pre-established threshold, r' DR . If 
the dual-channel residual does not exceed the threshold, the 
redundant measurements on both channels are acceptable. 
Otherwise, at least one of the dual channels is faulty. This 
process can only determine whether at least one channel of the 
dual-channel sensor is faulty, but not which channel is faulty. 

In addition to the comparison between the dual channels, 
the comparison of the dual channels against the model output is 
performed as follows: 

i i 

i _ Ta _ y LOBEM 

'A ~ 


i _ y B y LOBEM 

'B 


[ he residual in Eq. (6) is called the “analytical residual.” The 
analytical residual computed for each channel of each sensor is 
compared against a pre-established threshold, r' 4R . The 
LOBEM generates the expected output values of the engine 
operating without any faults. If an analytical residual exceeds a 
threshold, it indicates the existence of an anomaly. 

Through the comparison of triplex channels, the FDI logic 
determines the root cause of the problem based on the 
following assumptions: 

• Only one sensor may be faulty at a time, i.e., either one or 
both channels of this sensor may be faulty at a time. 

• Multiple components may be faulty at a time. 

• Only one of the above two conditions occurs at a time. 

The FDI logic indicates one of the following conditions: 1) 
sensor fault detected, 2) sensor fault isolated, 3) component 
fault detected, or 4) anomaly detected. Each of these 
conditions is discussed in the following section, and a flow 
chart of the FDL logic is given in the Appendix. 
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Sensor Fault Detection. The FDI logic indicates that 
“a sensor fault is detected” when one of the dual-channel 
residuals in Eq. (5) exceeds the threshold r‘ DR , but all 
analytical residuals in Eq. (6) remain below the threshold r‘ AR . 
This scenario happens depending on the fault magnitude and 
the threshold values. In this condition, the identity of a faulty 
dual-channel sensor is determined, but the identity of its failed 
channel cannot be determined. 

Sensor Fault Isolation. The FDI logic indicates that “a 
sensor fault is isolated” when the dual-channel residual of a 
particular sensor exceeds the threshold r' DR , and also, this 
sensor’s analytical residual exceeds the threshold v' AR in either 
one or both channels. If the threshold violation of the 
analytical residual occurs only in one channel, the channel that 
caused this violation is identified as the faulty one. If the 
threshold violation occurs in both channels, both channels of 
this particular sensor are considered faulty. Thus, the identity 
of a faulty sensor and the identity of its failed channel are 
determined. 


Component Fault Detection. Although sensor faults 
are most likely to occur [6], aircraft engines may experience 
faults in rotating components. When the engine experiences a 
component fault, multiple engine parameters deviate from their 
nominal condition values. As a result, the analytical residuals 
in Eq. 6 will change, but the dual-channel residuals in Eq. 5 are 
unaffected as long as the sensors are functioning normally. 
Therefore, a component fault can be detected through the 
observation of changes in the analytical residuals. Since the 
analytical residuals are influenced not only by a component 
fault but also by a sensor fault, care must be paid to observe a 
feature that is intrinsic to a component fault. 

A component fault generally causes an increase in the 
analytical residuals of multiple sensors. This is a major 
difference from the single sensor fault case, where the 
analytical residual of one sensor prominently increases. To 
utilize this knowledge, a component fault signature (CFS) is 
computed for each of the dual channels A and B as follows: 


cfs a = 
cfs b = 


m 

z 

/= 1 

m 

Z 


f A 


v r ^ j 
f i V 


\ T AR J 


- a 

~P 


where 


a = max 


K t ar J 


B = max < 

1=1,.. 


\ T AR J 


(7) 


( 8 ) 


With a total of m dual-channel sensors, m analytical residuals 
are calculated for each channel. The scalars a and /? in Eq. (8) 
are the maximum ratio of the analytical residual to the 
threshold t' ar for channel A and B, respectively, among the m 
dual-channel sensors. These scalars correspond to the 
analytical residual of a given channel that is largest in 
magnitude with respect to its threshold. This maximum ratio 
value is subtracted from the summation in Eq. (7). 

When a single sensor is faulty, the analytical residual of 
the faulty sensor will increase while the analytical residuals of 
other sensors are unaffected. Consequently, the analytical 
residual of the faulty sensor becomes the maximum among the 
m analytical residuals, and this maximum is subtracted in the 
CFS calculation. Therefore, the CFS value is unaffected by a 
single sensor fault. When a component is faulty, multiple 
engine parameters are affected, multiple analytical residuals 
will increase, and consequently, the CFS value will increase. 
As such, the increase in the CFS value indicates the existence 
of a component fault. 

The CFS for each channel is compared against a pre- 
established threshold, r CFS . When the CFS exceeds the 
threshold in at least one channel while all dual-channel 
residuals remain below the threshold z ' nR , the FDI logic 
indicates that “a component fault is detected.” 

Anomaly Detection. The FDI logic indicates that “an 
anomaly is detected” when it determines that something is 
abnormal, but it is unable to classify the anomaly into one of 
the three categories previously listed. This occurs when at least 
one of the analytical residuals exceeds the threshold z‘ AR , while 
all dual-channel residuals and CFS remain below their 
corresponding thresholds. Such a scenario can be induced by 
different causes. One possibility is a sensor fault: one channel 
of a sensor is actually faulty and thus causes a threshold 
violation of an analytical residual, but the fault magnitude is 
too small to cause the dual-channel residual of this sensor to 
exceed its corresponding threshold. This can happen 
depending on the threshold values. Another possibility is a 
component fault. A component fault influences the analytical 
residuals and CFS. Depending on the damaged component, 
fault severity, and the noise in the dual channels, one of the 
analytical residuals may exceed a threshold, while the CFS 
remains below its threshold. As such, the cause of the 
threshold violation is not obvious in this scenario. The FDI 
logic indicates the existence of an anomaly when the specific 
identity of a fault cannot be determined. 

It is possible to encounter a scenario where both channels 
of a sensor fail in a similar manner, and the dual-channel 
measurements remain in good agreement. In such a case, the 
dual-channel residual of the failed sensor does not exceed its 
threshold. Thus, the FDI logic indicates the existence of an 
anomaly, instead of a sensor fault, when the analytical residual 
of this sensor exceeds its threshold in at least one channel. 
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INFLUENCE OF HEALTH DEGRADATION 

Up to this point, the focus of this paper has been on the 
detection and isolation of faults that the aircraft engines may 
encounter. A fault is an abnormal event that happens 

unexpectedly. Such an event influences the observed engine 
behavior to some extent, and therefore, can be detected through 
the comparison of triplex channels. There is, however, a major 
phenomenon that also influences engine behavior and causes 
anomalous signatures in the measurements. This phenomenon 
is engine health degradation. Engine health degradation is a 
normal aging process that all aircraft engines will experience as 
a result of usage. It is not considered as a fault, but its 
influence on the engine performance grows over time. 
Eventually the on-line system will lose its diagnostic 
effectiveness if health degradation is not accounted for in the 
diagnostic process. 

The health condition of an engine is defined by the vector 
h in Eq. (1) which contains health parameters. The health 
condition at an instant of time can be expressed as follows: 

h - h k + &h (9) 

The vector h k represents health degradation. Since health 
degradation progresses gradually over the lifetime of an engine, 
h k is treated as a constant vector in the time scale at which the 
on-line system operates (i.e., real-time operation). The 
subscript k indicates the time index of a much longer time scale 
at which the change in health degradation takes place (i.e., k 
may increment once every few flights or few days). The vector 
A h represents a component fault that can occur abruptly at any 
instant of time. The on-line diagnostic system aims to detect 
this component fault when it happens. If there is no component 
fault, health degradation defines the health condition of the 
engine at a given instant. 

As discussed earlier, the LOBEM in Eq. (4) is developed at 
a specific health condition (e.g., nominal health condition), and 
this design condition is called the health baseline. As long as 
this health baseline and the true health condition of the real 
engine are in close proximity, the LOBEM accurately 
represents the real engine’s performance. As the engine 
continues to degrade, the difference between the true health 
condition and the health baseline increases. With such an 
increase of health condition mismatch, the LOBEM becomes a 
poor representation of the real engine and consequently 
corrupts the diagnostic capability of the baseline system. To 
address this problem, the LOBEM must be adjusted or updated 
periodically so that it can account for the influence of health 
degradation. 

There are a number of possible approaches for updating 
the LOBEM. One approach is to modify Eq. (4) into the 
following form: 


* LOBEM ^( X LOBEM X ss) + ^i U cmd ^ref) 

y LOBEM ~ LOBEM ~ X ss ) + ^{ U cmd _ U ss ) + ^i^k ~ ^ ref )"*" Tss 

( 10 ) 

As the engine degrades over time, the difference between the 
true health condition and the health baseline, h k — h r , , 

increases. Equation (10) captures the influence of this 
difference by incorporating the term h k - h ri , f . The vector h k 

represents the estimate of true health degradation h k , and it is 
assumed that this estimate is provided by a trend monitoring 
algorithm as demonstrated in Ref. [7]. As long as the estimate 

is reasonably accurate (i.e., h k ~ h k ), the influence of health 
degradation on engine variables is accounted for through the 
influence coefficient matrices L and M. 

This approach appears attractive because of its simplicity. 
However, it has some drawbacks. One of the drawbacks is that 
the relationship between health parameters and engine variables 
must be linear, so that the influence of health degradation can 
be captured through the matrices L and M. Such a linear 
relationship often does not hold for aircraft engines. Another 
drawback is that Eq. (10) does not capture the “off-design” 
closed-loop effect. Regardless of health degradation, aircraft 
engines must maintain specific variables of interest, such as fan 
speed or engine pressure ratio, at the target condition. To 
achieve this objective, the control system adjusts its commands 
as the engines degrade. This closed-loop control action 
changes the steady-state relationship of engine variables. The 
new relationship becomes “off-design” with respect to the 
original relationship at which the LOBEM was developed. As 
health degradation progresses over time, the off-design 
relationship departs further from the original, and the steady- 
state vectors , u ss , and y ss which capture the original 
relationship become obsolete. As such, the adjustment of the 
LOBEM through Eq. (10) only works if the nonlinearity and 
the closed-loop effect are moderate. 

An alternative approach to account for the influence of 
health degradation, while addressing the issues of nonlinearity 
and closed-loop effect, is to periodically update the LOBEM to 
a new health baseline through the re-generation of piecewise 
linear models. As discussed in Ref. [7], health degradation is 
estimated by a trend monitoring algorithm periodically over the 
course of the engine’s life. Using this estimate, the LOBEM 
can be updated to a new health baseline through the following 
steps. First, the health baseline of the nonlinear engine model 
in Eq. (3) is set to the estimated health condition as follows: 

Kf=K (11) 

Then, at the new health baseline, the piecewise linear models 
are generated from the nonlinear engine model. Re-generated 
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piecewise linear models take into account the influence of 
health degradation on engine variables as long as the health 
estimate is reasonably accurate. Through this process, the 
LOBEM in Eq. (4) is updated to a new health baseline and is 
able to remain as a reasonably accurate representation of the 
degraded engine. This update process must be completed 
periodically over the lifetime of the engine so that the LOBEM 
can operate in the vicinity of the true health condition of the 
degraded engine. 

The drawback of this approach is its complexity. The 
process of re-linearizing the nonlinear engine model may have 
to take place on a ground-based computer with human 
intervention. Furthermore, after the re-linearization process, 
the piecewise linear models must be uploaded to the FADEC. 
Such complexity raises a number of questions regarding the 
practicality of this approach. 

Updating the LOBEM is a highly challenging problem. 
Unless this problem is addressed, the LOBEM developed at a 
specific health baseline eventually becomes an obsolete 
representation of a degraded engine and consequently corrupts 
the diagnostic capability of the baseline system. In a later 
section, the influence of health degradation on the baseline 
system’s performance is investigated. 

APPLICATION OF THE BASELINE SYSTEM 

In this section, a description of the nonlinear aircraft 
engine model is given. Based on this model. The LOBEM is 
developed, followed by the derivation of threshold values used 
by the FD1 logic. For the results presented in this paper, the 
same nonlinear engine model used to generate the baseline 
system is used to represent a real engine. 

Engine Model 

The engine model used in this paper is a nonlinear 
simulation of an advanced high-bypass turbofan engine, a 
typical power plant for a large commercial aircraft. This engine 
model has been constructed as a component level model, which 
consists of the major components of an aircraft engine. The 
engine model captures highly complex engine physics. Engine 
performance deviations from the nominal health condition are 
modeled by adjustments to efficiency and flow capacity scalars 
of the following five components: fan (FAN), booster (BST), 
high-pressure compressor (HPC), high-pressure turbine (HPT), 
and low-pressure turbine (LPT). There are a total of 10 
adjustments that are called health parameters. The engine state 
variables, health parameters, actuator variables, and 
environmental parameters are shown in Table 1 . 

There are a total of 10 measured parameters (y and z) that 
are available to the digital control unit of this engine. Table 2 
shows seven measured parameters (y) along with their standard 
deviations given in percent of steady-state values at the ground 
maximum power condition. These parameters are measured by 
dual-channel sensors with channels A and B. It is assumed that 


both channels have the same statistical characteristics. The 
control action and diagnostics are based on those sensed 
variables. Table 3 shows three additional measured parameters 
(z) along with their standard deviations given in their actual 
engineering units. These three parameters indicate the ambient 
and engine inlet conditions. The two measured parameters P am b 
and P2 are used to calculate altitude and Mach number. The 
measurements of the inlet condition, T2 and P2, are used for 
parameter correction [8], These three parameters are necessary 
to run the LOBEM over the flight envelope. Faults in these 
parameters are not considered in this paper. 

The nonlinear engine model is used in the subsequent 
sections to represent a real engine in Eq. (1). The engine 
operates at given health conditions, and its flight condition is 
specified by the three environmental parameters listed in Table 
1. This engine operates in closed loop with a control system 


TABLE 1. 

ENGINE MODEL VARIABLES 

State Variables 

XNL, XNH, TMHS23, TMHS3 
TMHSBL, TMHSBC, TMHS41 
TMHS42, TMHS5 

Health 

Parameters 

FAN efficiency, FAN flow capacity 
BST efficiency, BST flow capacity 
HPC efficiency, HPC flow capacity 
HPT efficiency, HPT flow capacity 
LPT efficiency, LPT flow capacity 

Actuators 

WF36, VBV, VSV 

Environmental 

Parameters 

Altitude, Mach Number 
Ambient Temperature 


TABLE 2. STANDARD DEVIATIONS OF CONTROLS AND 
DIAGNOSTICS SENSORS (cr IN % OF STEADY-STATE 
VALUES AT GROUND MAXIMUM POWER CONDITION) 


Sensors (>j 

a (%) 

XN 12 

0.25 

XN25 

0.25 

P25 

0.50 

T25 

0.75 

PS3 

0.50 

T3 

0.75 

T49 

0.75 


TABLE 3. STANDARD DEVIATIONS OF AMBIENT AND 
ENGINE INLET SENSORS (a IN ACTUAL UNITS) 

Sensors (z) 

a 

Pamb 

0.1 psi 

T2 

5.0° F 

P2 

0.1 psi 
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described in Ref. [9]. In the current control architecture, the 
power lever angle (PLA) is converted to desired corrected fan 
speed (an indicator of thrust). The control system adjusts 
actuation variables to cause the corrected measured fan speed 
to match the desired value. The closed-loop system runs at the 
frequency of 50 Hz. 

Linear On-Board Engine Model 

The LOBEM is developed through the linearization of the 
nonlinear engine model in Eq. (3) at multiple operating points 
over the flight envelope. During this linearization process, the 
health condition of the nonlinear engine model is set to a 
specific condition (e.g., nominal health condition), and this 
condition is called the health baseline. The piecewise linear 
models are then saved in table lookup form. Figure 1 shows 
the structure of the LOBEM. The LOBEM is partitioned into 
two segments: steady-state segment (steady-state vectors) and 
dynamic segment (state-space matrices). The steady-state 
segment captures nonlinear engine characteristics along the 
engine’s steady-state operating line, while the dynamic segment 
captures the engine’s behavior due to perturbations from the 
steady-state operating line. These two segments are in table 
lookup form and interpolated based on schediding parameters 
as the operating condition of the real engine moves from one 
point to another. The LOBEM generates the expected engine 
outputs at operating conditions over the flight envelope. 

The number of scheduling parameters corresponds to the 
dimension of the LOBEM that must be interpolated. It is 
desirable to keep this dimension as small as possible so that the 
LOBEM can be run in real time with little computational 
burden. As mentioned in Ref. [10], it is essential to have an 
accurate representation of the expected steady-state engine 
performance characteristics. Also mentioned is that it is not 
necessary to schedule both segments with the same scheduling 
parameters. Based on this observation, the LOBEM’s steady- 
state and dynamic segments are interpolated differently. 

The steady-state segment is composed of steady-state 
vectors generated at operating conditions over the full range of 
altitude, Mach number, and PLA. The steady-state segment is 
interpolated by three scheduling parameters: computed altitude, 
computed Mach number, and computed corrected fan speed. 
The computed corrected fan speed is a state variable of the 
LOBEM and is closely related to power setting. As mentioned 
in the “Engine Model” section, altitude and Mach number are 
computed from P2 and P am b measurements. If altitude and 
Mach number measurements are available, the measured values 
can be used instead of computed values. 

The dynamic segment is composed of state-space matrices 
generated at the sea-level-static and cruise operating conditions 
over the full range of PLA. The dynamic segment is 
interpolated by two scheduling parameters: P2/P amb and 
computed corrected fan speed. 

The steady-state segment is set up in three dimensions 
while the dynamic segment is set up in two. With this 



FIGURE 1. STRUCTURE OF THE LOBEM 


structure, the LOBEM accurately represents the real engine’s 
behavior over the flight envelope while keeping the 
computational burden low. 

Selection of Threshold Values 

In the diagnostic approach based on triplex channels, 
multiple thresholds must be determined. First, the threshold 
t‘ dr for the dual-channel residual in Eq. (5) must be 
determined for each of the m sensors. Similarly, the threshold 
r' 4R for the analytical residual in Eq. (6) must be determined 
for each of the m sensors. The same threshold value is used for 
both channels of each sensor. Finally, the threshold z CFS for 
CFS in Eq. (7) must be determined for channels A and B, and 
the same threshold value is used for both channels. The total 
number of threshold values that must be determined is 2/77+ 1 . 

The threshold values for dual-channel residuals can be 
determined relatively easily. The dual-channel residuals are 
neither influenced by engine health degradation nor component 
faults. They are influenced only by sensor failure and sensor 
noise. Thus, the main concern for determining the threshold 
values is to make sure that the sensor noise does not cause a 
threshold violation. Based on this consideration, the threshold 
values can be determined for seven dual-channel sensors in 
Table 2. 

Unlike the dual-channel residuals, the analytical residuals 
are influenced not only by sensor failure and sensor noise but 
also by other factors such as engine health degradation, model- 
plant mismatch, and component faults. Similarly, CFS is 
influenced by the same factors except sensor failure. Since 
health degradation and model-plant mismatch are not 
considered to be faults, it is necessary to assure that these 
factors do not cause a threshold violation. 

As discussed in an earlier section, the influence of engine 
health degradation must be accounted for by periodically 
updating the LOBEM to a new health baseline. As long as the 
health baseline of the LOBEM is maintained in the close 
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vicinity of the degraded engine’s true health condition, the 
analytical residuals and CFS can be maintained within a 
reasonable range of their nominal condition values. 

The model-plant mismatch is another factor that must be 
considered in determining the threshold values. In the real 
environment, some degree of mismatch between the real engine 
and the LOBEM always exists due to unmodeled and 
incorrectly modeled physical phenomena. To make sure that 
the model-plant mismatch does not cause a threshold violation, 
the threshold values are determined through the same process 
taken in Refs. [9,11]. In this process, the influence of model- 
plant mismatch on analytical residuals and CFS is investigated 
through Monte-Carlo simulation; the nonlinear engine model 
(representing a real engine) and the LOBEM are run with 
different levels of health condition mismatch between them. 
The values of analytical residuals and CFS vary over a certain 
range because of this mismatch. The thresholds are set to 
values higher than the maximum values that the analytical 
residuals and CFS can reach due to mismatch. With this 
approach, it can be ensured that a threshold violation does not 
occur at least for the mismatch used in the simulated cases. 

In the current setup, dual-channel residuals, analytical 
residuals, and CFS are processed by a low-pass filter with a 
cutoff frequency of 1.0 rad/sec (0.16 Hz). All these signals are 
compared against the thresholds, and a threshold violation is 
declared when any signal persistently exceeds its 
corresponding threshold. For this study, a threshold violation is 
declared when a threshold is exceeded 25 consecutive time 
steps (0.5 sec). This persistency test is carried out to ensure the 
existence of a fault. Based on the threshold violations 
occurring from the engine, the FD1 logic determines the root 
cause of the anomaly. The low-pass fdter design and 
persistency test are adjusted based on the engineering judgment 
of the designer. The performance of the diagnostic system will 
vary with those design factors. 

PERFORMANCE EVALUATION 

In this section, the performance of the baseline system is 
evaluated in a simulation environment using faidts in sensors 
and components. Figure 2 shows the simulation setup. The 
nonlinear engine model is used to represent the real engine. 
Since accommodation of sensor faults is beyond the scope of 
this paper, the control system is configured to use the 
measurements on channel A regardless of fault existence. 
Sensor faults are injected into channels A and B individually to 
investigate the effect of control action. 

The baseline system is evaluated at a cruise condition, and 
the threshold values at this operating point are shown in Table 
4. ' The evaluation is conducted at the ideal condition; there is 
no seeded model-plant mismatch between the engine and the 


1 For full flight envelope evaluation, different threshold values should be 
used at different operating points, and the adaptive threshold approach 
discussed in Ref. [9] could be used during transient operation. 


Fault Degradation 



FIGURE 2. SIMULATION SETUP OF THE 
BASELINE SYSTEM 


TABLE 4. THRESHOLD VALUES AT CRUISE CONDITION 


Sensors 

^ DR ( C ) 

t AR ( a ) 

XN12 

±2.0 

±3.6 

XN25 

±2.0 

±5.2 

P25 

±2.0 

±1.5 

T25 

±2.0 

± 1.4 

PS3 

±2.0 

± 1.7 

T3 

±2.0 

± 1.6 

T49 

±2.0 

±1.6 

r =12 

i, CFS 


LOBEM, other than the mismatch incurred by the linearization 
of the nonlinear engine model. Also, the same noise 
characteristics are used for both channels A and B. The 
robustness of the baseline system to engine health degradation 
is investigated first. 

Robustness to Engine Health Degradation 

The baseline system eventually diagnoses engine health 
degradation as a fault unless the health baseline (design health 
condition) of the LOBEM is updated to a new health condition. 
In this section, the level of health degradation at which the 
baseline system starts indicating the existence of a faidt is 
determined. The engine is simulated to degrade gradually over 
its lifetime along the health degradation profile shown in Fig. 3. 
This degradation profile was developed in Ref. [7]. The life 
span of the engine is divided into 300 sample points in this 
example. The health condition at the k th sample point is defined 
by the vector h k in Eq. (9). At each sample point, the engine is 
run at a steady-state cruise condition with a given health 
condition. While the engine degrades over its lifetime, the 
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FIGURE 3. ENGINE HEALTH DEGRADATION PROFILE 


health baseline of the LOBEM is maintained at the initial 
design condition: the nominal health. 

The baseline system starts indicating the existence of a 
component fault at the 37 th sample point of the health 
degradation profile. At this point, only one health parameter 
has reached 1% deviation. This level of health degradation is 
far from the condition where a maintenance action is necessary. 
Thus, the diagnostic result, if trusted, can lead to an 
unnecessary maintenance action or inspection. One of the 
approaches to avoid such an undesirable scenario is to set the 
thresholds to much higher values so that a threshold violation 
does not occur until the health condition reaches a severe or 
full deterioration level. This approach, however, will 
compromise the diagnostic capability; the missed detection rate 
will increase. Another approach is to periodically update the 
LOBEM as discussed earlier. Although practical issues must 
be resolved, the model update is a necessary step to maintain 
the on-line diagnostic capability over the lifetime of an engine. 

Sensor Fault Diagnostics 

The baseline system’s capability to detect and isolate a 
biased sensor is evaluated in this section. A bias is injected into 
channel A or B of a single sensor at a time. The health 
condition of the engine and the health baseline of the LOBEM 
are set to the nominal health. In the presence of a sensor bias, 
the closed-loop system is trimmed at a cruise operating 
condition. Then, the simulation in Fig. 2 is run at steady-state 
for 100 seconds. When any of the signals (dual-channel 
residuals, analytical residuals, and CFS) exceed a threshold for 
25 consecutive time steps, a threshold violation is declared. 
Based on the threshold violations occurring from the engine, 
the FDI logic determines the root cause. 


Table 5 shows the result of sensor fault diagnostics. The 
numbers in parenthesis are the results for cases where a bias is 
injected into channel B (open-loop configuration). The 
Anomaly Detection column shows the level of bias at which 
the baseline system detects the existence of an anomaly. At this 
point, the nature of the anomaly cannot be determined. The 
Sensor Fault Detection column shows the level of bias at which 
the baseline system detects a faulty dual-channel sensor. At 
this point, the identity of the faulty sensor is determined, but 
the identity of the faulty channel cannot be determined. The 
Sensor Fault Isolation column shows the level of bias at which 
the baseline system identifies the faulty channel of a faulty 
sensor. For instance, when a bias of 1.4a is injected into 
channel A of the P25 sensor, at least one of the analytical 
residuals exceeds a threshold, indicating the existence of an 
anomaly. When the bias is 1.8a, the dual-channel residual of 
the P25 sensor exceeds its threshold, and therefore a fault is 
detected in this sensor. At the same bias magnitude, the 
analytical residual of this sensor also exceeds the threshold in 
channel A, and the baseline system declares that channel A of 
the P25 sensor is faulty. When the XN12 or XN25 sensor is 
biased, the dual-channel residuals of these sensors exceed their 
threshold before any of the analytical residuals do. Therefore, 
anomaly detection does not occur for these two sensors. 

The table shows that the sensor fault detection is achieved 
at the same bias level for all seven sensors. This is due to the 
fact that the thresholds for dual-channel residuals are set to the 
same value for all seven sensors, as shown in Table 4. It should 
be noted that the sensor fault detection, which is achieved 
through the comparison of dual-channel measurements of each 
sensor, is not influenced by control action, and thus the result is 
not affected whether a biased channel is A or B. 

For those sensors other than XN12 and XN25, sensor fault 


TABLE 5. SENSOR FAULT DIAGNOSTIC RESULT 



Anomaly 

Sensor Fault 

Sensor Fault 


Detection (a) 

Detection (a) 

Isolation (a) 

XN12 

-/- 

1.8 / -1.8 

3.4/ -3.6 
(3.5/ -3.5) 

XN25 


1.8 / -1.8 

2.9/ -4.2 
(5.0/ -5.0) 

P25 

1.4 / -1.5 
(1.3/ -1.3) 

1.8 / -1.8 

1.8 / -1.8 
(1.8 / -1.8) 

T25 

1.3 / -1.4 
(1.2 / -1.3) 

1.8 / -1.8 

1.8 / -1.8 
(1.8 / -1.8) 

PS3 

1.5 / -1.6 
(1.5 / -1.6) 

1.8 / -1.8 

1.8 / -1.8 
(1.8 / -1.8) 

T3 

1.4 / -1.6 

1.8 / -1.8 

1.8 / -1.8 

(1.4 / -1.5) 

(1.8 / -1.8) 

T49 

1.4 / -1.5 
(1.4 / -1.5) 

1.8 / -1.8 

1.8 / -1.8 
(1.8 / -1.8) 


The numbers in parenthesis are the result for cases where a bias is 


injected into channel B (open-loop configuration). 


NASA/TM— 2008-215228 9 


detection and isolation are achieved at the same bias level. 
This is a desirable result. When a sensor fault is detected, it is 
desirable to isolate the sensor problem to the specific faulty 
channel as early as possible. By knowing the root cause of the 
detected problem, the follow-up corrective actions can be taken 
sooner. 

For the XN12 and XN25 sensors, sensor fault isolation is 
achieved at much higher bias levels than sensor fault detection. 
The difficulty in identifying the faulty channel for these two 
sensors is due to the threshold values for analytical residuals. 
As shown in Table 4, the thresholds for analytical residuals are 
set to much higher values for these two sensors than the other 
sensors. Higher threshold values are selected for fan and core 
speeds since they are highly coupled with control action, and 
the analytical residuals of these two sensors vary over a wide 
range in the presence of model-plant mismatch. 

The influence of control action can be observed most 
prominently when the XN25 sensor is biased; the level of bias 
being isolated is much lower in channel A (closed-loop) than 
channel B (open-loop). This is because core speed (XN25) is 
the primary variable used in scheduling the VSV position. 
When a biased XN25 value is used by the control system, the 
engine is driven to a new steady-state condition. At the new 
operating condition, the relationship between the engine 
variables are “off-design” with respect to the original 
relationship at which the LOBEM was developed. This off- 
design closed-loop effect further aggravates the output 
mismatch between the engine and the LOBEM and actually 
helps the baseline system to detect biases of smaller magnitude. 

Component Fault Detection 

The baseline system’s capability to detect component faults 
is evaluated in this section. The health condition of the engine 
and the health baseline of the LOBEM are set to the nominal 
health. A component fault is represented by an abrupt shift in a 
health parameter, and it results in transient operation of the 
closed-loop system until the engine settles to new trim point. 
After the injection of a component fault, the engine is run for 
100 seconds during which a diagnostic result is generated 
continuously by the baseline system. Because of the transient 
operation, the baseline system may indicate the existence of an 
anomaly for a certain period and then indicate the existence of 
a component fault. During this simulation run, if the baseline 
system indicates the existence of a component fault at least 
once, it is considered that the component fault is detected. If 
the baseline system does not indicate the existence of a 
component fault but indicates the existence of an anomaly at 
least once, it is considered that an anomaly is detected. If none 
of the above occurs (i.e., the baseline system indicates that a 
fault does not exist), it is considered that the baseline system 
misses the component fault. 

Table 6 shows the component fault scenarios used in this 
evaluation study. The same scenarios were used as in Ref. [9]. 
Fault scenarios 1 through 5 represent single-component fault 


TABLE 6. COMPONENT FAULT SCENARIOS 


Fault Scenario 

Faulty Components 

1 

FAN 

2 

BST 

3 

HPC 

4 

HPT 

5 

LPT 

6 

FAN & BST 

7 

BST & HPC 

8 

FAN &BST & HPC 

9 

HPT & LPT 

Damage Level 

Range of F ault Magnitude 

1 

[1%, 2%] 

2 

[2%, 3%] 

3 

[3%, 4%] 

4 

[4%, 5%j 


cases while fault scenarios 6 through 9 represent multiple- 
component fault cases. For each fault scenario, four levels of 
component damage are considered for evaluation. At each 
damage level, the efficiency and flow capacity of the faulty 
component(s) are independently shifted through a random 
process within the range shown in the table. This range is 
considered to encompass reasonable failure scenarios. All 
component shifts are made in the negative direction, except for 
HPT and LPT flow capacities which are shifted in the positive 
direction. At each damage level of each fault scenario, 100 
fault cases are generated by randomly shifting health 
parameters. Thus, a total of 3600 component fault cases are 
used in the evaluation. 

Table 7 shows the result of the component fault 
diagnostics. There are three possible diagnostic results that the 
baseline system may produce: 1) component fault detection, 2) 
anomaly detection, and 3) missed detection. In each cell of the 
table, the number of component fault cases that resulted in each 
of the three possible conditions appears in the aforementioned 
order. The best result that the baseline system can achieve is 
100/0/0. The result 0/100/0 indicates that the baseline system 
detects the existence of an anomaly but cannot determine the 
nature of the anomaly. The result 0/0/100 indicates that the 
baseline system completely misses the component faults. 

It can be observed from the table that the baseline system 
is able to detect faults in HPC, HPT, and LPT. It has some 
difficulty in detecting BST faults when the fault level is 3 or 
below. The baseline system encounters the most difficulty in 
detecting FAN faults; it misses most of the FAN fault cases. As 
discussed in Ref. [9], this is due to the fact that the 
measurement shifts induced by FAN faults are difficult to 
observe through the sensor set used in this study. 

It should be noted that the baseline system only indicates 
the existence of component faults without identifying the 
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TABLE 7. COMPONENT FAULT DIAGNOSTIC RESULT 


Fault 

Scenario # 

Faulty 

Components 

Level 1 

Level 2 

Level 3 

Level 4 

1 

FAN 

0/0/100 

0/0/100 

5 / 3/92 

46/6/48 

2 

BST 

0/0/100 

0/0/100 

20/27/53 

100/0/0 

3 

HPC 

37/12/51 

100/0/0 

100/0/0 

100/0/0 

4 

HPT 

100/0/0 

100/0/0 

100/0/0 

100/0/0 

5 

LPT 

98/0/2 

100/0/0 

100/0/0 

100/0/0 

6 

FAN/BST 

0/0/100 

0/0/100 

0/3/97 

99/0/1 

7 

BST/HPC 

43 /27/30 

100/0/0 

100/0/0 

100/0/0 

8 

FAN/BST/HPC 

47/26/27 

100/0/0 

100/0/0 

100/0/0 

9 

HPT/LPT 

100/0/0 

100/0/0 

100/0/0 

100/0/0 


Each cell shows the number of component fault cases that resulted in the following three categories: 
Component fault detection, anomaly detection, and missed detection 


specific faulty components. To determine the identity of faulty 
components, the measurements must be further processed 
through an algorithm, such as a bank of Kalman filters which 
was demonstrated in Ref. [12]. 

Possible Design Adjustment 

The evaluation results presented in this section indicate the 
level of diagnostic performance that can be achieved at a cruise 
condition. If the performance is not satisfactory, the baseline 
system must be adjusted. The design elements that influence 
the achievable performance are 1) the sensor noise filter, 2) the 
persistency test, and 3) the threshold values. Among these 
three elements, a possible adjustment of the threshold values is 
specifically discussed in this section. 

When heuristic knowledge regarding the target system is 
available, the threshold values should be adjusted accordingly. 
For instance, the evaluation results presented in this paper show 
that by applying a 2a threshold value for the dual-channel 
residuals (Table 4), a sensor fault is declared when the bias 
magnitude reaches 1.8g (Table 5). This means that any steady- 
state disagreement between the dual-channel measurements that 
exceeds 1.8a will be diagnosed as a sensor fault. In the real 
environment, disagreement between the channels may be 
induced by something other than a sensor fault. For instance, if 
the sensing elements of a dual-channel sensor are placed at 
different circumferential locations, the dual-channel 

measurements may not agree with each other because of three 
dimensional flow effects. If it is known that such a 

disagreement can be greater than the sensor faidt detection 
level (1.8a for the current design), the threshold should be set 
at a higher value in order to avoid false alarms. 

Similarly, the thresholds for the analytical residuals can be 
adjusted in order to balance the anomaly detection capability 
and false alarm rates. This adjustment, however, should be 
done with care. If the threshold for an analytical residual is set 
much higher than the threshold for a dual-channel residual, the 


sensor fa Lilt isolation capability will suffer; it will take a much 
greater fault magnitude to be isolated than to be detected. This 
is the case for the XN12 and XN25 sensors. The objective of 
utilizing an analytical third channel is to isolate an in-range 
sensor fault. This objective is defeated if sensor fault isolation 
can only be achieved at a much greater fault magnitude than 
required for sensor fault detection to be achieved. 

DISCUSSION 

When the baseline system detects abnormal behavior of an 
aircraft engine, some actions must be taken to prevent 
undesirable engine operation. In this section, the corrective or 
accommodation actions that should be taken based on the 
baseline system’s diagnostic results are discussed. 

When the baseline system indicates the existence of an 
anomaly, the nature of that anomaly is unknown. In this case, 
an immediate action to accommodate the anomaly cannot be 
taken. Instead, the data generated by the baseline system must 
be further investigated. Anomaly detection is triggered when at 
least one of the analytical residuals exceeds a threshold while 
all dual-channel residuals and CFS remain below their 
threshold. These signals give some clue regarding the nature of 
the anomaly. For instance, when a sensor is faulty, the 
analytical residual of only one sensor should have exceeded its 
corresponding threshold while the analytical residuals of all 
other sensors and CFS remain at or near their nominal values. 
Moreover, the dual-channel residual of the same sensor should 
display some deviation from its nominal value, although it still 
remains below its corresponding threshold. On the other hand, 
when a component is faulty, some deviation from the nominal 
should appear in both channels of CFS and analytical residuals. 
As such, through the investigation of the data, the nature of the 
detected anomaly can be inferred. 

When the baseline system detects a fault in a specific 
sensor, it is necessary to investigate the data generated by the 
baseline system and determine the failed channel. An 
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immediate accommodation action can be taken only when the 
faulty channel of a faulty sensor is identified. If one channel is 
faulty, the measurement of the non-failed channel is used by the 
control system. If both channels of a particular sensor are 
faulty, the model output should be used. 

Unlike the dual-channel sensors, the rotating components 
are not dual redundant. Therefore, the accommodation 
approach in the case of a component fault is fundamentally 
different from that of a sensor fault. When a component is 
faulty, it is important to know the engine’s performance 
parameters such as thrust, compressor stall margins, and 
combustor temperature [13,14]. By knowing these parameters, 
the engine could be controlled within its operability limits 
while providing the thrust requested by the pilot. Thus, a 
reliable technique to estimate those un-measurable performance 
parameters is necessary for component fault accommodation. 

A type of hardware failure, besides sensor and component 
faults, that was not discussed in this paper is an actuator fault. 
When an actuator fails to settle at a commanded position, this 
actuator is considered faulty. Generally, the actuator positions 
are measured, and the measured positions are fed back to the 
FADEC [4,15]. Detection and isolation of actuator faults can 
be achieved by comparing the commanded and measured 
actuator positions. When the difference exceeds a tolerance 
level for a specific actuator, this actuator is considered faulty. 
The actuators are not dual redundant, but different 
combinations of actuators can be used to achieve a certain 
objective. Therefore, an actuator fault could be accommodated 
through the manipulation of the remaining actuators based on 
pre-computed failure accommodation schedules [16] or 
adjustments [17]. 

CONCLUSION 

The baseline system described in this paper was developed 
to diagnose aircraft gas turbine engine faults on-line (real-time, 
in-flight). The baseline system utilizes dual-channel sensor 
measurements and also the output of a linear on-board engine 
model (LOBEM) as the analytical third channel. Through the 
comparison of triplex channels, the baseline system diagnoses 
faults in sensors and rotating components. 

The baseline system was evaluated extensively at a cruise 
operating condition using simulated fault cases. The baseline 
system exhibited its capability to identify a faulty dual-channel 
sensor and its failed channel at a reasonable fault level. The 
baseline system also exhibited its capability to detect 
component faults. To maintain such diagnostic capabilities, 
however, the baseline system must be updated periodically as 
the engine degrades over its lifetime. This periodic update is a 
major challenge that must be addressed for any on-line 
diagnostic algorithm which is designed at a specific health 
condition. The diagnostic capability of the baseline system 
establishes a benchmark for on-line diagnostics. Any 
improvement made through the application of advanced 
diagnostic techniques can be evaluated against this benchmark. 
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